Log Centralization GCTD Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team manages workloads across AWS, Azure, and GCP. They need a single pane of glass to detect cross-cloud attacks, such as an attacker using a stolen AWS key to pivot into an Azure VM. Which approach best meets this need?

   • AConfigure each cloud's native monitoring service to send its logs to a central SIEM using agent-based forwarders and API integrations.
   • BStore all logs in object storage in each cloud and rely on the cloud provider's support team to analyze them during an incident.
   • CUse a single cloud provider for all workloads to eliminate the need for log centralization.
   • DEnable CloudTrail, Azure Activity Log, and GCP Cloud Audit Logs, and review each console separately during incident response.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   An organization operates workloads across multiple cloud providers and on-premises infrastructure. Which outcome is a direct benefit of implementing a centralized logging architecture?

   • AIt eliminates the need for separate security monitoring tools.
   • BIt allows security analysts to search and analyze logs from all environments in a single interface.
   • CIt automatically encrypts all logs in transit and at rest without configuration.
   • DIt guarantees that all logs are retained indefinitely at no additional cost.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company suspects a breach where an attacker used a compromised service account to access cloud resources. The SIEM has logs from cloud APIs, authentication, and network flows. Which correlation would most likely reveal the attacker's actions?

   • AJoin authentication logs with API call logs using the service account name and timestamps.
   • BReview the service account's permissions in the cloud console.
   • CSearch for all API calls made by any account in the last 24 hours.
   • DLook only at network flow logs for unusual traffic patterns.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team manages a multi-cloud environment with workloads in AWS and Azure. They need a single pane of glass to investigate a suspected credential-stuffing campaign that may span both clouds. The team already has a SIEM platform that supports both cloud providers' native log export mechanisms. Which approach best meets the requirement while minimizing the number of moving parts?

   • AConfigure AWS CloudTrail to deliver logs to an S3 bucket and Azure Activity Log to a storage account, then have the SIEM ingest from both locations.
   • BUse Azure Monitor as the central repository and have AWS send logs to it via a custom webhook.
   • CInstall a third-party log shipper on every EC2 instance and Azure VM to forward application logs directly to the SIEM.
   • DStore all logs in a single S3 bucket and use AWS Athena to query them, ignoring Azure-native logs.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A multinational company must comply with both GDPR and local data residency laws. They are centralizing logs from all regions into a single SIEM. The SIEM is hosted in the EU, but some logs originate from a region where data must remain within the country. What is the best approach?

   • ADeploy a log aggregator in the restricted country that filters and forwards only non-restricted logs to the central SIEM, while storing restricted logs locally.
   • BUse a SIEM provider that offers a local region in the restricted country and replicate all logs there.
   • CStore all logs in the restricted country and access them remotely from the SIEM.
   • DSend all logs to the EU SIEM and rely on encryption to protect the data.
   Reveal Solution Discussion Select an answer first